CVE-2019-7550

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

En JForum 2.1.8, un atacante remoto no autenticado puede enumerar si un usuario existe mediante la función "create user". Si una petición register/check/username?username= se corresponde con un nombre de usuario existente, se produce un error "is already in use". NOTA: este producto se ha descontinuado.